The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local Bash script (scripts/crawlora.sh) to perform REST API calls. The script demonstrates high security awareness by implementing several defenses:
It validates the CRAWLORA_API_KEY format to prevent injection into temporary configuration files.
It enforces a strict whitelist for the path argument, allowing only three specific drug-research routes.
It rejects path syntax that could be used for directory traversal or shell smuggling.
It explicitly blocks the @ character in query arguments to prevent the curl tool from reading local system files.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize external pharmacy price snapshots, which introduces a potential surface for indirect prompt injection if a drug description or API response were to contain malicious instructions.
Ingestion points: Data retrieved from the GoodRx endpoints via scripts/crawlora.sh as described in SKILL.md and reference/endpoints.md.
Boundary markers: The skill lacks explicit boundary markers (like XML tags or specific delimiters) to separate external data from system instructions in the agent's context.
Capability inventory: The skill has the ability to execute shell commands and read environment variables.
Sanitization: The skill performs rigorous sanitization of outgoing request parameters but does not include specific sanitization or filtering logic for the content returned by the API before it is consumed by the agent.

prescription-price-research